Page 1 of 26

FLORIDA DEPARTMENT OF FINANCIAL SERVICES FLORIDA PALM PROJECT

RFQ Florida PALM 15/16-17 Business Case for Maintaining Agency Business Systems

Statement of Work and Request for Quote

Page 2 of 26

1. Purpose. The Department of Financial Services (the “Department”), Florida PALM (Planning, Accounting, and Ledger Management) Project (Project) issues this Request for Quotes (RFQ) from Respondents, as defined in Section 2 below, who are able and willing to provide the services in accordance with this Statement of Work (SOW). This RFQ/SOW defines the scope and requirements of the purchase order (PO) to be issued pursuant to either the State Term Contract (STC) for Management Consulting Services, No. 973-000-14-01 or Information Technology (IT) Consulting Services, No. 973-561-10-1, Project Area 1. In compliance with line 2317A of the 2016 General Appropriations Act, the PO is needed for a third party consulting firm to complete the business case for maintaining any of the agency business systems identified in Attachment 2 of the March 31, 2014, Florida Department of Financial Services Florida Accounting and Information Resource (FLAIR) Study,” version 031, after the FLAIR subsystem and the Cash Management System (CMS) are replaced.

2. Definitions.

The following are key terms included within the SOW. 1. Business Days – Monday through Friday, inclusive, except for holidays declared and observed by the

state government of Florida. Whether capitalized or not, “day” means business day (defined as the Department’s normal working hours) unless otherwise described.

2. Business Process Standardization (BPS) Track – The Florida PALM Project Track responsible for

developing and executing business process standardization activities. This is one of four Project Tracks, as defined in Section 3D.

3. Contractor – For the purposes of the Pre-DDI phase of the Florida PALM Project, these are individuals or groups providing support services. A list of these services can be found at: http://www.myfloridacfo.com/floridapalm/SupportServices.htm. (Also referred to as consultant in the STC.)

4. Department of Financial Services (the Department) – The State agency overseen by the Chief Financial Officer that also administratively houses the Offices of Finance Regulation and Insurance Regulation. Website: http://www.myfloridacfo.com/.

5. Division of Accounting & Auditing (A&A): The division within the Florida Department of Financial Services responsible for safeguarding public assets, settling the State’s financial obligations, reporting financial information, and improving accountability of the State. A&A is the functional owner of FLAIR.

6. Division of Information Systems (DIS) – The division within the Florida Department of Financial Services that plans, manages, and operates the Department’s information technology resources. DIS is the technical owner of all Department applications including FLAIR and CMS.

7. Enterprise Resource Planning (ERP) – Business process management software that allows an

organization to use a system of integrated applications to manage the business and automate back office functions. The Florida PALM Project is focusing on a financial management ERP.

8. FLAIR Study (FLAIR Study)– A document delivered in March 2014 to the Florida Department of Financial Services that provides an evaluation and recommendations for the enhancement or replacement

Page 3 of 26

of the State’s current financial management systems. Option 3 to “replace FLAIR and CMS” was the ultimate recommendation of the FLAIR Study.

9. Organizational Change Management (OCM) Track - The Florida PALM Project Track responsible for leading, delivering, and supporting the execution of organizational change management and workforce transition strategies, tools, programs, curriculum, training, and plans. This is one of four Project Tracks.

10. Project Management Office (PMO) – The Florida PALM Project Track responsible for developing and executing project management strategies for all Project phases. The PMO Track is also responsible for managing procurement activities. This is one of four Project Tracks.

11. PO – The Purchase Order documents to be issued by the Department in the form of a State purchase order.

12. Master Project Schedule - A tool outlining the work to be performed, which resources of the organization will perform the work, and the timeframes during which the work will be performed. The project schedule should reflect the activities and tasks associated with delivering the project. The Florida PALM Project maintains a Master Project Schedule for all Project work.

13. State – The state of Florida. 14. State Data – Any data or information of or concerning the State or the Department that is provided to or

obtained by the Contractor or Contractor personnel in connection with the performance of the Contractor’s obligations under the PO, including any such data and information that either (i) is created, generated, collected or processed by Contractor personnel in the performance of the Contractor’s obligations under the PO, including data processing input and output, performance measurements, asset information, reports, third party service and product contracts, and the Contractor’s charges to the Department, or (ii) resides in or is accessed through the Department operating environment or the Contractor’s service delivery infrastructure; as well as any data and information derived from the foregoing

15. Treasury – A division within the Florida Department of Financial Services that performs the cash

management and investing activities for the State. The Treasury is the functional owner of CMS.

3. Background.

Section 215.93, Florida Statutes (F.S.), establishes the Florida Financial Management Information System (FFMIS) for the State. FFMIS is comprised of the accounting, budgeting, cash management, human resources and procurement subsystems. For nearly two decades, all of the FFMIS subsystems ran on legacy technology. To date, only the human resources and procurement subsystems have been fully modernized. A portion of CMS was modernized in August 2013. FLAIR has been performing the State’s accounting and payroll functions for thirty years. Although it has been maintained and modified over the years to accommodate state and federal mandates, it is becoming increasingly unable to meet the State’s changing and growing needs. Issues and concerns with FLAIR include limited integration with the other subsystems (batch vs. transactional processing), incomplete reporting capabilities, inability to perform offsets, inability to schedule and consolidate payments, and insufficient information to perform state‐level cash forecasting.

Page 4 of 26

In 2002, the Legislature appropriated funding for the then Department of Banking and Finance1 to undertake a project to replace the accounting and cash management subsystems, FLAIR and CMS, respectively. Project Aspire, as it was called, suffered insurmountable challenges and was ultimately cancelled in 2007. In 2013, the Department began efforts to evaluate the options and best approach for replacing the FLAIR and CMS.  A. Florida Accounting Information Resource - FLAIR

FLAIR is a double entry, computer‐based general ledger accounting system consisting of the following four components:

Departmental Accounting: Maintains agencies’ accounting records and is utilized at the end of each

fiscal year to prepare financial statements in accordance with generally accepted accounting principles.

Central Accounting: Maintains cash basis records and is used by the Chief Financial Officer (CFO) to ensure that expenditures are made in accordance with the legislative appropriations.

Payroll Accounting: Processes the State’s payroll.

Information Warehouse: Provides a reporting system that allows users to access Central Accounting information and most Departmental Accounting information in FLAIR.

FLAIR is a mature subsystem, supported at the data center located within the Department. FLAIR is fully implemented in 35 state agencies with approximately 12,000+ individual users at 400+ accounting office sites throughout the State. FLAIR typically processes 95+ million accounting transactions, accounting for a $90+ billion budget, and pays 180,000+ State personnel, annually. Not all State agencies use FLAIR exclusively for their accounting functions. Further, there are numerous specialized accounting methods and agency business systems used by state agencies in addition to FLAIR.

B. Cash Management System ‐ CMS

The Division of Treasury (the “Treasury”) receives and disburses funds, invests available balances, performs related accounting functions, cash management operations, and consultations. The Treasury operates separate systems (collectively known as “CMS”) to carry out its responsibilities of monitoring cash levels and activities in State bank accounts, for keeping detailed records of cash transactions and investments for State agencies, and paying of warrants and other disbursements issued by the CFO. These functions or activities include exchanging information between FLAIR, Department of Revenue, other State agencies, and business partners, i.e., financial institutions.

C. The FLAIR Study In accordance with proviso language in section 42 of the 2013 General Appropriations Act (GAA), the Department procured the services of an independent consulting firm to complete a FLAIR Study to recommend either replacement or remediation of FLAIR and CMS. The FLAIR Study, completed by The North Highland Company in partnership with Grant Thornton and Thomas, Howell, Ferguson (the North Highland Team), included an assessment of implementing an ERP system for the State and an inventory of agency business systems interfacing with FLAIR. Based on the analysis completed in the FLAIR Study, the recommendation is that the State of Florida should replace FLAIR and CMS with a commercial off-the-shelf ERP solution. This option was selected based on information collected from the market conditions and trends and the analysis of both qualitative and quantitative factors, including: Alignment to Goals and Objectives

1 Effective January 7, 2003, the Department of Banking and Finance and the Department of Insurance merged into the new Florida Department of Financial Services.

Page 5 of 26

Cost Comparison Benefits Comparison Risk Analysis The cost model of the FLAIR Study was a projection based on a series of assumptions to provide the Department with a way to compare the options and provide an estimate for total cost of ownership. The estimate was provided for the Department to consider when making the initial legislative budget request. The FLAIR Study included Attachment 2, which is comprised of an inventory of current agency business systems interfacing with FLAIR. The inventory of agency business systems interfacing with FLAIR can be found at: http://www.myfloridacfo.com/floridapalm/documents/140409-DOF05-Final-FLAIR-Study-D5-dAttach2-v100.pdf The background and analysis of the inventory can be found at: http://www.myfloridacfo.com/floridapalm/documents/140408-DOF05-D3-Inventory-Analysis-v100.pdf

For full details, the FLAIR Study can be found at: http://www.myfloridacfo.com/floridapalm/FlairStudy.htm

D. Florida PALM Project Structure and Timeline

The multi-year Florida PALM Project will have at least three parts or “phases”: a. Pre-DDI – This initial phase (the Pre-Design, Development and Implementation or “Pre-DDI”

phase) includes planning, business process standardization, and procurement of the financial management software solution.

b. DDI Phase 1 – This phase will implement the financial management software solution focusing on core functionality (functionality currently performed by Central FLAIR, Departmental FLAIR, Information Warehouse, and selected CMS functions).

c. Future DDI Phases – Subsequent phases beyond what is defined for DDI Phase 1 (e.g., transition from Grant Accounting to full Grant Management functionality) will include the implementation of the remaining functionality necessary to meet the solution goals.

The Project is currently in the Pre-DDI phase. Currently the Project is organized into multiple “Tracks” or work streams that are staffed to simultaneously support the mission of the Project. The Tracks for Pre-DDI are: BPS – Business Process Standardization OCM – Organizational Change Management SDS – Systems and Data Strategy PMO – Project Management Office (includes Procurement)

4. Scope of Work.

A. In accordance with proviso language in section 2317A of the 2016 General Appropriations Act, the Department of Financial Services shall contract with a third party consulting firm to complete the business case for maintaining any of the agency business systems identified in Attachment 2 of the March 31, 2014, Florida Department of Financial Services FLAIR Study, version 031, after the FLAIR

Page 6 of 26

subsystem and the CMS are replaced. The Department is required to submit the business case to the Executive Office of the Governor, the President of the Senate, and the Speaker of the House of Representatives no later than November 1, 2016.

B. The following Section describes the scope of work to be performed by the Contractor. The deliverables

associated with the tasks identified in the scope of work are further defined in Section 5 – Deliverables Acceptance Criteria. All tasks and deliverables will be coordinated with the Contract Manager. The Contractor will collaborate with the Department’s contract manager (Contract Manager) to perform the following tasks, at a minimum:

1. Develop a business case in accordance with proviso language in section 2317A of the 2016 General

Appropriations Act, in which, the Contractor shall consider the information associated with the agency business systems that was collected during the FLAIR Study referenced above. At a minimum, the business case shall include: A detailed description of the functionality provided by the agency business system; Confirmation that the agency business system’s functionality is not planned to be included in the

replacement of the FLAIR subsystem and CMS; and Documentation including federal and state law, rule, or policy, which validates that the agency is

required to maintain the functionality currently provided by the agency business system instead of modifying its business processes.

2. Communicate project status to the Department. The Contractor will prepare and submit weekly status

reports (SDS4) using an approved template beginning (2) weeks after PO issuance and weekly throughout the duration of the PO to the Department, and will conduct weekly status meetings. These can be conducted by conference call, although in person meetings are preferred.

3. Use the Department’s SharePoint site to maintain all data, working, draft, and final files. 4. Present in person, the methodology and results of the Business Case for aintaining Agency Business

Systems (SDS5) before the Legislature or other oversight entities upon request until the last day of the Legislative Session 2017.

5. Deliverables Acceptance Criteria.

The following criteria will be used to determine when each deliverable in the table below is considered complete and acceptable. The Department’s Contract Manager or designee may provide additional acceptance criteria to be used for the Deliverables. The Contractor will submit all deliverables listed below.

Deliverable Acceptance Criteria

Deliverable: SDS4 Description: Weekly Status Report Due Date of Deliverable: Beginning two weeks after PO issuance and weekly thereafter.

Minimum Acceptance Criteria: A Microsoft Word 2013 document shall be provided as written status reports beginning within two weeks after PO issuance and weekly thereafter, using an approved template, until completion of the PO.

Page 7 of 26

Status reports are due via email to the Contract Manager by 12:00 pm Eastern Time (ET) each Friday (unless instructed otherwise in writing by the Contract Manager) until completion of the Contractor’s services, and shall include: a. A narrative description of significant activities that have been conducted or are underway; b. The progress-to-date on the business case development activities (including % complete of

activities included in the Project Master Schedule; c. An explanation of any tasks/activities that are behind schedule and a plan to bring them current; d. Notification of any problems that have been encountered and their resolution or plan for future

resolution; and e. Goals or upcoming deadlines.

Deliverable: SDS5 Description: Business Case for Maintaining agency Business Systems Due Date of Deliverable: (To be provided by the Contractor as part of the Response and accounting for the deadline for the Department to submit the final report by November 1, 2016)

Minimum Acceptance Criteria: A Microsoft Word 2013 or PowerPoint 2013 that includes at a minimum: a. An Executive Summary; b. A description of the approach to the business case development; and c. A description of findings of the business case

A Microsoft Excel 2013 spreadsheet of an updated version of Attachment 2 including information necessary to support the methodology employed for the business case. It shall include at a minimum: a. A detailed description of the functionality provided by the agency business system; b. Confirmation that the agency business system’s functionality is not planned to be included in the

replacement of the FLAIR subsystem and CMS; and c. Documentation including Federal and state law, rule, or policy, which validates that the agency is

required to maintain the functionality currently provided by the agency business system instead of modifying its business processes.

6. Acceptance of Work.

This Statement of Work includes both daily, ongoing tasks, as well as defined PO deliverables (SDS4 through SDS5). Acceptance of work will be provided on a monthly basis, for tasks and activities as defined during the invoicing period.

C. All deliverables shall be submitted to the Contract Manager for review and approval (“Acceptance”) in accordance with the agreed upon schedule unless otherwise approved by the Contract Manager in writing. The Department will only accept each deliverable when it has been reviewed and signed off that it meets the applicable criteria specified in this SOW, including the standards and guidelines referenced herein.

The Department anticipates to complete their review of deliverables within 10 days after receiving the deliverable. The Department may return a deliverable for modification. The Contractor will have up to 10 calendar days after receiving request for modification to cure and return deliverable to the Department. If

Page 8 of 26

additional cure and review cycles are needed, the Contractor and the Department will have seven (5) to ten (10) calendar days to review, request revisions or make modifications. If either the Contractor or the Department needs additional time to review, modify, or cure the deliverables, the request will be submitted in writing by email to the Contract Manager for consideration. The Department may provide additional acceptance criteria during the PO period to be used for the deliverables. The Department reserves the right to require the Contractor to revise deliverables previously approved at no additional cost to the Department for any inadequate or insufficient information. The invoices will not be paid for deliverables that fail to meet specifications until acceptable corrective action has been completed.

Failure to accept a deliverable within thirty (30) calendar days of an original or revised deliverable submission means automatic non-acceptance by the Department unless stated otherwise by the Contract Manager or designee in writing. See Section 17.O for additional financial consequences associated with deliverables.

D. Any tools, templates, or applications developed and work conducted by the Contractor pursuant to this

SOW shall be performed in accordance with DIS standards and specifications. These standards will be strictly adhered to and are available at the following website: http://www.myfloridacfo.com/Division/DIS/ISDM/. New application development activities are defined as “activities that result in the creation of new source code with the expected outcome of satisfying a business need for the first time in the chosen development language.” New application development and technology upgrade activities are required to follow the Department Information Systems Development Methodology (ISDM) and the Department Application Development Standards unless prior written exemption is approved by DIS. The Department ISDM Life Cycle Checklist is a roadmap to ensure critical checkpoints and deliverables are met.

7. Facilities and Equipment.

A. Upon completion of security awareness training by the Contractor’s personnel who will be assigned to this Project, the Department shall provide necessary access to the Department network.

B. The Contractor will be required to supply its own computer hardware and telephone.

8. Qualification Requirements for the Contractor. A. Experience.

The Department is seeking a third party consulting firm that assigns resources with the following qualifications: Demonstrated experience developing business cases for information technology systems; Demonstrated experience collecting data, surveying, and data validation standards associated; Demonstrated experience working with Florida agencies; Demonstrated experience with and knowledge of the capabilities of commercial, off-the-shelf

financial ERP software; and Demonstrated knowledge of federal and state law, rule, and policy.

B. Staff Commitment. The Contractor shall, at a minimum, provide a project manager (Project Manager) that will work in conjunction with the SDS Manager to oversee the Contractor’s activities. The Contractor shall dedicate sufficient staff to provide adequate support of the scope of project. The Contractor will not remove any dedicated staff assigned to the PO. The Project reserves the right to require the removal from the Project any Contractor personnel found, in the judgment of the Project, to be unacceptable. Contractor staff that work on the Project must successfully complete the Department security awareness training. The Contractor’s staff assigned to this project shall use any

Page 9 of 26

information available only for the purpose of carrying out the provisions of the PO. Information contained in Project documents such as deliverables, drafts, e.g., draft schedules and strategies, PO artifacts, and State Data will be treated as confidential. Confidential information will not be divulged by the Contractor or made known in any manner to any person except as may be necessary in the performance of the PO. Disclosure of confidential information to anyone other than an officer or employee of the Department is prohibited, except with express direction or consent of the Department.

C. Background checks.

A level 2 background check shall be completed and reviewed before Contractor staff may work on this Project. The Contractor must advise its candidates that: (1) the fingerprints will be used to check the criminal history records of the FBI; and (2) procedures for obtaining a change, correction, or updating of an FBI identification record are described in 28 CFR 16.34. In the event records reveal evidence of a crime that is unacceptable as determined by the Department, the Contractor agrees to remove the employee from the Project and replace the employee with someone with comparable knowledge, skills and abilities.

The Department will provide instructions for providing fingerprints and other information needed for obtaining background checks and submitting them to the Department upon award.

D. Scrutinized Companies.

If the Response is for goods or services of $1 million or more, the Respondent shall certify that the Respondent, as a company as defined in section 287.135, F.S., is not on the Scrutinized Companies with Activities in Sudan List or the Scrutinized Companies with Activities in the Iran Petroleum Energy Sector List. (See http://www.state.gov/s/ct). Notice: Section 287.135, F.S., would operate to make businesses ineligible to contract with the State in specified circumstances. Currently, the 2012 changes to this section were enjoined by a court of law and upheld by an appellate court. The State has determined to not pursue enforcement of the enjoined portion of the law related to refusing to contract with vendors who engage in business operations in Cuba or Syria, except with respect to which the U.S. Department of Commerce, the U.S. Department of State or the U.S. Department of Treasury maintains any commercial activities sanctions program.

9. RFQ Overview. The Department releases this RFQ to make a purchase using one of the STCs identified in Section 1. The Department may select a qualified Respondent(s) based on the Responses. Responses will be evaluated for compliance with the SOW and STC. The selected Respondent(s) will enter into a contract with the Department through a PO completed in MyFloridaMarketPlace (MFMP).

10. Resulting PO. The PO will incorporate the MFMP Terms and Conditions, available at http://www.dms.myflorida.com/content/download/117735/646919/Purchase_Order_Terms_Sept_1,_2015_.pdf , STC, SOW/RFQ Section 17, Special Conditions, the other provisions of the SOW/RFQ, Addendum A- Public Records, Addendum B – Data Security, and the Respondent’s Response.

11. Submission of Response. Interested Respondents should respond to the RFQ by submitting a Response that must include, at a minimum, the Respondent’s qualifications and proposed methodology for performing the above described services and the cost associated with providing the services. The applicable STC number must be referenced within the Response. Responses will only be accepted from Respondents with a valid and current STC.

Page 10 of 26

Responses are due according to the schedule below:

Activity Anticipated Date Issue RFQ 04/25/2016 Deadline to submit questions via email 05/03/2016, 2pm ET The Department will respond to questions 05/12/2016 Deadline to submit Responses 05/27/2016, 2 pm ET Oral Presentations 06/07/2016 – 06/15/2016Anticipated Contractor selection 06/16/2016 Begin work 07/01/2016

The Department assumes no responsibility for missing or delayed Responses. Face-to-face interviews will be conducted as part of the review process. The interviews will address Contractor experience, qualifications, roles and responsibilities. Please send questions (referencing the RFQ# in the title) via email to the address shown below by the respective deadlines:

Brandi Babb Florida Department of Financial Services Brandi.Babb@myfloridacfo.com

Respondents shall submit Responses electronically (referencing the Respondent’s exact legal name and the RFQ# in the title) (via email to Brandi.Babb@myfloridacfo.com) by 2:00 p.m. eastern time (ET) in accordance with the timeline above. The Department assumes no responsibility for missing or delayed Responses. See Addendum A for information. Responses will be evaluated for compliance with the SOW and the RFQ.

Responses shall include: A. A single PDF document that contains:

An Introductory Letter and Letter of Commitment (limited to three pages). The letter shall include an executive summary that demonstrates the firm’s previous experience with business case development, and the length of time the Response is valid, which shall be no less than 180 days. The letter shall include the STC name and number and a certification statement that the company is not on the Scrutinized Companies list referenced in Section 8.D.

The Respondent’s approach (limited to 10 pages) for the development of the business case. Resumes (limited to 12 pages) for each Respondent proposed personnel assigned to the Project including the

proposed Contractor’s name, certifications, experience, and qualifications pertinent to this SOW. Clearly outline why his/her experience and qualifications separate them from other Respondents. Resumes are for evaluation and will not become part of the PO.

The Respondent will describe the mechanism for continuing the service including transferring the activities back to the state or successor contractor if the Respondent should become the Contractor and fails to perform and comply with the performance standards and the PO is terminated. In the event that the PO expires or terminates for any reason, the Contractor agrees to cooperate in the transition to the state or successor contractor. The contingency transition plan will include at a minimum training, transfer of data and transition period error correction.

A copy of the Respondent’s company signed STC with the Department of Management Services (DMS) and all required certifications; proof of insurance as required in Section 17.

Page 11 of 26

The Cost Response (using Attachment 1 of this RFQ) shall specify the fixed price per deliverable, the name and job title of proposed personnel assigned to the Project, number of hours anticipated, and hourly rates shall not exceed the STC for Management Consulting Services, No. 973-000-14-01 or Information Technology (IT) Consulting Services, No. 973-561-10-1, Project Area 1 rates.

B. A Microsoft Project 2013 schedule including the following:

Task and Milestone Names Duration Start and Finish Dates Predecessors and Successors Resources assigned

The schedule shall include all activities related to the work performed by the Contractor and any activities for

the Department and agencies. The schedule shall include tasks for the review of deliverables including drafts. The Respondent shall consider the review process described in Section 6A. The Department intends to integrate and baseline these tasks in the Master Project Schedule, therefore, the Respondent shall consider the level of detail necessary for tracking tasks, milestones, and reporting progress.

C. A draft Deliverable Expectations Document (DED), using the approved Project template (using Attachment 2

of this RFQ), that clearly articulates each deliverable’s expectations, acceptance criteria, and the distinct methodologies, tools, and approaches used to develop each deliverable. DED acceptance is a prerequisite for beginning deliverable development.

D. References for the Respondent’s contracting firm (using Attachment 3 of this RFQ). The Respondent shall

include three (3) references that are relevant to the requirements of this RFQ. The References will not become part of the PO. The Department reserves the right to contact references or previous employers of resources proposed.

12. Basis for Vendor Selection. Responses will be evaluated for compliance with the statement of work as well as minimum and preferred qualifications that indicate the Respondent’s ability to perform the activities specified in the RFQ. The Department intends to select a Contractor that provides the best overall value to the State. The Department will consider the Respondent’s full Response when making a selection, including the Respondent’s ability, experience, availability, and references in addition to the Respondent’s Cost Response. Respondents will be evaluated based on their qualifications as documented in the materials provided as required in Section 11. All other factors being equal, price will be the determining factor.

13. Conflict of Interest. It is essential to the proper conduct and operation that the Contractor and its personnel are independent and impartial and that the implementation of decisions made as it relates to the procurement is not used for private gain or other remuneration. The Contractor and its personnel from this agreement shall refuse any override commissions or any other valuable consideration, in any and all forms, from any involved party. Fees earned relating to this agreement will be limited exclusively to payments by the Department to the Contractor under the purchase order issued subsequent to the awarding of this RFQ. It is the position of the Department that a Respondent or i ts subcontractor who is selected for this RFQ is, or will be, precluded from bidding on the following procurements:

Software and System Integrator (SSI), the solicitation for software and implementation services; IV&V - Independent Verification & Validation; and

Page 12 of 26

PMO - Project Management Office In addition, the Contractor and any subcontractors performing services as part of the PO may be excluded from award of future procurements dealing with that specific subject matter based on section 287.057(17)(b) and (c), F.S., which states in part:

“[a] person who receives a contract that has not been procured pursuant to subsections (1)‐(3) to perform a feasibility study of the potential implementation of a subsequent contract, who participates in the drafting of a solicitation or who develops a program for future implementation, is not eligible to contract with the agency for any other contracts dealing with that specific subject matter, and any firm in which such person has any interest is not eligible to receive such contract.”

14. Pricing and Invoicing.

A. The Respondent shall provide for a firm fixed-price using Attachment 1, Cost Response. Additionally, Attachment 1, Cost Response, shall include the name and job title of proposed personnel assigned to the Project, number of hours anticipated, and hourly rates. The hourly rates in Attachment A, Cost Response reflect costs that are included in the firm fixed price, and establish hourly rates for any amendments that address any modifications in scope that require a change in pricing. The Contractor will be paid on a fixed price basis in accordance with the applicable STC, subject to the conditions for Acceptance of Work set forth in Section 6 of the SOW.

B. No travel expenses shall be paid. C. Invoices shall be processed in arrears after acceptance and approval of deliverables. D. Invoices shall be submitted to the Contract Manager.

15. Term of PO The PO period for this RFQ begins upon issuance of the PO and ends 12 months from the from the PO effective date.

The Department reserves the right to require the successful Respondent to execute a two-party contract, to be attached to the PO that incorporates this solicitation and the Respondent’s Response as soon as possible after award.

16. Contract Manager.

All services will be performed under the direction and control of: Brandi Babb Department of Financial Services, Florida PALM Project 111 W. Madison Street, G08 Pepper Building Tallahassee, FL 32399-0365

The Department reserves the right to change the Contract Manager without a formal amendment to the PO. The Department will notify the Contractor by email, of any change.

17. State Term Contract Special Conditions.

A. Precedence. The PO and its attachments (which this SOW, the accepted portions of the Response, the STC, the MyFloridaMarketPlace Purchase Order Terms and Conditions available at http://www.dms.myflorida.com/content/download/117735/646919/Purchase_Order_Terms_Sept_1,_2015_.pdf, and the Response) comprise the entire PO documents. Pursuant to the STC, any additional terms and conditions outlined in this SOW are supplemental to those set forth in the STC. The SOW and accepted portions of the Response may serve as a PO; The SOW and Response may serve as a Task Order or purchase order under the STC and with the STC provisions shall constitute the PO between the parties; however, the SOW will supersede the Response in the event of any conflicting

Page 13 of 26

provisions. Such additional terms shall not conflict with the STC, except to the extent required by law. The STC can be viewed at the following DMS website: State Term Contracts

B. Taxes. The Department is exempted from payment of State sales and use taxes and Federal Excise Tax. The Department will provide its tax exemption certification upon request.

C. Limitation of Liability. No provision in the PO shall require the Department to hold harmless or indemnify the Contractor, insure or assume liability for the Contractor’s negligence, waive the Department’ sovereign immunity under the laws of Florida, or otherwise impose liability on the Department for which it would not otherwise be responsible. Except as otherwise provided by law, the parties agree to be responsible for their own attorney fees incurred in connection with disputes arising under the terms of the PO. The Department maximum liability for any damages, regardless of form of action, shall in no event exceed the fees actually paid to the Contractor for the relevant products or services giving rise to the liability, prorated over a term from the date of performance of the applicable services.

D. Public Records. See Addendum A, attached.

E. Governing law. The Contractor and all its agents shall comply with all federal, state and local

regulations applicable to the PO. With regard to limitation of actions, section 95.11, F.S., shall govern. Florida law shall govern the PO and jurisdiction shall be in Leon County, FL.

F. Change Process. The Contractor shall contact the Department Contract Manager or designee to request any changes to the PO (Change Order Process). If the Contractor fails to notify and obtain approval from the Department before commencing performance of activities relating to changes in the PO, such activities will be considered to be performed gratuitously by the Contractor, and the Contractor shall not have any right thereafter to assert any claim for additional compensation or time for the performance of such activities.

G. Asset Usage. To the extent applicable, the Department may, upon termination or expiration of the PO, purchase any assets used by the Contractor in performance of the PO, at their depreciated value, or if not depreciated, then the Department retains the right to negotiate to purchase such assets at an agreed-upon cost, not to exceed the price offered in any STC.

H. Default. The Department reserves the right to perform the service or activity, directly or with another Contractor, if service levels are not being achieved. The Department may, in addition to other remedies available to them at law or equity and upon notice to the Contractor, retain such monies from amounts due the Contractor as may be necessary to satisfy any claim for damages, costs and the like asserted by or against them.

I. Termination. All services performed by the Contractor prior to the termination date of the PO shall be professionally serviced to conclusion in accordance with the requirements of the PO. Should the Contractor fail to perform all services under the PO, the Contractor shall be liable to the Department for any fees or expenses that the Department may incur in securing a substitute provider to assume completion of those services. The Department may, in its sole discretion, provide notice and an opportunity to cure the default rather than exercise the remedy of termination. If the default or breach is not cured within thirty (30) calendar days after written notice is given to the Contractor specifying the nature of the alleged default or breach, then the Department, upon giving written notice to the Contractor, shall have the right to terminate the PO effective as of the date of receipt of the default notice. The Department shall have the right to unilaterally cancel or suspend the PO, by providing the

Page 14 of 26

Contractor thirty (30) days written notice. The Contractor shall not perform any services after it receives the notice of termination, except as necessary to complete the transition or continued portion of the PO, if any.

J. Electronic Accessibility. The Electronic and Information Technology standard can be found at: www.section508.gov. If applicable, section 508 compliance information on the supplies and services in the PO are available on a website indicated by the Contractor.

K. Employment Eligibility Verification. 1. The Chief Financial Officer has directed, in cooperation with the Governor’s Executive Order 11-

116, that the Contractor must participate in the federal E-Verify Program for Employment Verification under the terms provided in the “Memorandum of Understanding” with the federal Department of Homeland Security governing the program if any new employees are hired to work on the PO during the term of the PO. The Contractor agrees to provide to the Department, within thirty days of hiring new employees to work on the PO, documentation of such enrollment in the form of a copy of the E-Verify “Edit Company Profile” screen, which contains proof of enrollment in the E-Verify Program. Information on “E-Verify” is available at the following website: www.dhs.gov/e-verify.

2. The Contractor further agrees that it will require each subcontractor that performs work under the PO to enroll and participate in the E-Verify Program if the subcontractor hires new employees during the term of the PO. The Contractor shall include this provision in any subcontract and obtain from the subcontractor(s) a copy of the “Edit Company Profile” screen indicating enrollment in the E-Verify Program and make such record(s) available to the Department upon request.

3. Compliance with the terms of this Employment Eligibility Verification provision will be an express condition of the PO and the Department may treat a failure to comply as a material breach of the PO.

4. In the event legislation authorizes an alternative option as proof of legal status, the Contractor may use the process authorized by such legislation upon its passage.

L. Insurance. The Contractor shall submit appropriate proof of insurance. Such proof of insurance will

become part of the PO. At a minimum, amounts reasonably associated with the PO include the following types of insurance for anyone directly or indirectly employed by the Contractor and the amount of such insurance shall be the minimum limits as follows, unless otherwise approved by the Department Contract Manager or designee: 1. Commercial general liability coverage, bodily injury, property damage: $1,000,000 per

occurrence/$2,000,000 aggregate. 2. Automobile liability coverage, bodily injury, property damage: $1,000,000 Combined Single

Limits. Insuring clause for both bodily injury and property damage shall be amended to provide coverage on an occurrence basis.

3. Workers’ compensation and employer’s liability insurance covering all employees engaged in any Contract work, in accordance with Chapter 440, F.S.

4. Submit appropriate proof of computer crime insurance and coverage against intentional acts as well as negligent acts or omissions in connection with its activities under the PO.

5. Such coverage may be reduced with the consent of the Department Contract Manager or designee. Except as agreed in a separate writing, no self-insurance coverage shall be acceptable unless Contractor is licensed or authorized to self-insure for a particular coverage listed above in the State, or is an in insured member of a self-insurance group that is licensed to self-insure in the State.

M. Ownership and Rights. All of the data collected or created for or provided by the Department (State

Data) shall become and remain the Department property upon receipt and acceptance.

Page 15 of 26

All deliverables shall become and remain the Department property upon receipt and acceptance. All elements of custom software developed within the scope of the PO shall be exclusively owned by of the Department and shall be considered works made for hire for the Department. Title to all property furnished by the Department under the PO shall remain in the Department, and the Contractor shall surrender to the Department all property of the Department prior to settlement upon completion, termination, or cancellation.

N. State property. Title to all property furnished by the Department under the PO shall remain in the Department, and the Contractor shall surrender to the Department all property of the Department prior to settlement upon completion, termination, or cancellation. All deliverables shall become and remain the Department property upon receipt and acceptance. All work materials developed or provided by the Contractor under the PO and any prior agreement between the parties shall be deemed to be work made for hire and owned exclusively by the State, and the Department.

At the end of term the Contractor will provide all of State Data in a standard industry format. At a minimum the Contractor agrees to provide to the Department data definitions, table structure, the Department data under its control, and any custom code required to allow the Department a smooth transition to in-house or substitute vendor implementation of similar functionality to that provided by the Contractor. Where activities supported by the PO produce original writing, sound recordings, pictorial reproductions, drawings or other graphic representation and works of any similar nature, the Department has the right to use, duplicate and disclose such materials in whole or in part, in any manner, for any purpose whatsoever and to have others acting on behalf of the Department to do so. If the materials so developed are subject to copyright, trademark, or patent, legal title and every right, interest, claim or demand of any kind in and to any patent, trademark or copyright, or application for the same, will vest in the State’s Department of State for the exclusive use and benefit of the state. Pursuant to section 286.021, F.S., no person, firm or corporation, including parties to the PO, shall be entitled to use the copyright, patent, or trademark without the prior written consent of the Department of State. The Department shall have unlimited rights to use, disclose or duplicate, for any purpose' whatsoever, all information and data developed, derived, documented, or furnished by the Contractor under the PO. All computer programs and other documentation produced as part of the PO shall become the exclusive property of the State’s Department of State and may not be copied or removed by any employee of the Contractor.

O. Financial Consequences for Non-Performance.

1. To the extent that financial consequences are not further specified in the SOW, the following apply: a. Failure to meet the acceptance criteria as identified in the SOW will result in automatic

Deliverable rejection and may not be invoiced or paid until correction of the Deliverable. Failure to complete the required duties not associated with a Deliverable as outlined in the Statement of Work may also result in the rejection of the invoice. Notwithstanding any provisions to the contrary, written acceptance of a particular Deliverable does not foreclose the Department’s remedies in the event those performance standards that cannot be readily measured at the time of delivery are not met.

b. The sanction for untimely delivery of a deliverable is that payment may not be made until successful deliverable acceptance in writing.

c. Nothing in this section shall be construed to make the Contractor liable for delays that are beyond its reasonable control. Nothing in this section shall limit the Department right to pursue its remedies for other types of damages.

Page 16 of 26

2. Step-in Rights. For discontinuance of the performance of the work, failure to resume work that has been discontinued within a reasonable time after notice to do so, abandonment of the PO, or for noncompliance by the Contractor with tasks related to public records, the Department at its option may enforce these provisions by exercising “Step-In” rights as described below: a. If the Department exercises its Step-In rights, the Contractor must cooperate fully with the

Department (including its personnel and any third parties acting on behalf of the Department) and shall provide, at no additional charge to the Department, all assistance reasonably required by the Department as soon as possible, including:

b. Providing access to all relevant equipment, premises and software under the Contractor’s control as required by the Department (or its nominee); and

c. Ensuring that the Contractor personnel normally engaged in the provision of the public records tasks are available to the Department to provide assistance which the Department may reasonably request.

d. The Department Step-In rights will end, and the Department will hand back the responsibility to the Contractor, when the Contractor demonstrates to the reasonable satisfaction of the Department that the Contractor is capable of resuming provision of the tasks in accordance with the requirements of the SOW and that the circumstances giving rise to the Step-In right cease to exist and will not recur.

e. The Contractor must reimburse the Department for all reasonable costs incurred by the Department (including reasonable payments made to third parties) in connection with exercise of the Department Step-In rights (Step-In Costs); and provision of the affected public records tasks shall be in accordance with Addendum A to the extent applicable.

f. The Department will continue to pay the Contractor the charges (including that portion which relates to the affected public records tasks) due for the products or services, provided that the Contractor reimburses the Department for the Step-In Costs. If the Contractor fails to reimburse the Department within 30 days of receipt of a demand from the Department for payment of Step-In Costs, the Department is entitled to set off such Step-In Costs against a subsequent invoice.

3. Reassignment of Personnel. The Department will have the right to recommend and approve in

writing the initial assignment, as well as any proposed reassignment or replacement, of any Contractor personnel. Before assigning an individual to any position of the Project, the Contractor will notify the Contract Manager of the proposed assignment, will introduce the individual to the appropriate Project representatives, and will provide the Contract Manager with a resume and any other information about the individual reasonably requested by the Project, three weeks before the individual is assigned. The Contract Manager reserves the right to interview the individual before granting written approval. a. Contractor shall not remove any resource from their assigned roles during the term of the PO.

An Unauthorized Removal is a removal at any point in the PO period. It shall not be considered an Unauthorized Removal if personnel must be replaced for reasons beyond the reasonable control of the Contractor, including illness, disability, resignation, or for cause termination of the personnel’s employment. However, Contractor is to identify a replacement approved by the Contract Manager and assign the replacement to the PO to shadow the personnel he or she is replacing for a period of at least four weeks prior to such removal. There will be no increase in cost and no change in due date as a result of the replacement personnel. Any Unauthorized Removal may be considered by the Department to be a material breach of the PO, and entitle the Department to terminate the PO.

b. It is acknowledged that any Removal may interfere with the timely and proper completion of the Project, to the loss and damage of the State, and that it would be impracticable and extremely difficult to fix the actual damage sustained by the State as a result of any Removal.

Page 17 of 26

Therefore, Contractor and the Department agree that in the case of any Removal, the Department may assess liquidated damages against Contractor as specified below. For amounts due to the Department as liquidated damages, the Department may at its option deduct the amount due from any money payable to Contractor by the Department or may bill Contractor as a separate item.

c. In the event of an Unauthorized Removal of any personnel, the liquidated damages amount shall not exceed $25,600.00 per individual provided Contractor identifies a replacement approved by the Department pursuant to subsection “a.” above and assigns the replacement to the Project to shadow the personnel he or she is replacing for a period of at least four weeks prior to such removal. i. If Contractor fails to assign an agreed upon replacement to shadow the removed personnel

for at least four weeks (20 business days), Contractor shall pay the amount of $1,621.84 per day, for each day of the twenty (20) day shadow period that the replacement personnel does not shadow the removed personnel, up to $32,436.80 maximum per individual. The total liquidated damages that may be assessed per Unauthorized Removal and failure to provide four weeks of shadowing shall not exceed $32,436.80 per individual.

ii. In the alternative, in the event of the Unauthorized Removal of any personnel, Department reserves the right to recruit, hire, or otherwise contract directly with any personnel who have performed services under the PO in the event such reassignment is proposed or occurs. In the event such reassignment is proposed, Contractor releases personnel from any non-compete agreement intended to bar such personnel from employment with Department. Contractor’s failure to replace personnel subsequent to such personnel’s Unauthorized Removal shall be deemed to be a material breach of the PO.

d. The Department reserves the right to require the removal from the Project of Contractor personnel found, in the judgment of the Department, to be unacceptable. Replacement personnel for the removed person shall have equal or superior experience and qualifications.

P. Data Security, Recovery, and Damages for Non-Performance. See Addendum B, attached.

Q. Other Work. The Department may undertake or award other contracts, statements of work, or other arrangements for additional or related work, and the Contractor shall reasonably cooperate with such other Contractors and pertinent Department personnel. The Contractor shall not commit or permit any act that shall interfere with the performance of work by any other Contractors or by Department personnel.

R. Duty to Cooperate. The Contractor understands its duty, pursuant to subsection 20.055(5), F.S., to cooperate with the inspector general in any investigation, audit, inspection, review, or hearing. The Contractor will comply with this duty and ensure that its subcontracts issued under this Contract, if any, impose this requirement, in writing, on its subcontractors.

Page 18 of 26

ATTACHMENT 1 - Cost Proposal

Use the templates below to propose not-to-exceed fixed price and fixed hourly rate contract pricing for providing all services outlined in this RFQ and in the vendor’s response. Pricing shall not exceed State Term Contract 973-000-14-01, Management Consulting Services, or State Term Contract 973-561-10-1, Information Technology (IT) Consulting Services for the term of the contract.

Fixed Price

Deliverable Deliverable Title Amount

SDS4 Weekly Status Report Non-invoiced

SDS5 Business Case for Maintaining agency Business Systems

Total Not-to-Exceed Amount

Hourly Rates

Job titles and hourly rates for staff assigned to the project should be included in the chart. The costs below are used for compliance verification purposes only.

Vendor Name:

STC Number:

Person Submitting Quote:

Signature:

Date:

Name Job Title

Anticipated No. of Hours Per Month

Hourly Rate

Total Cost

$ $

$ $

Page 19 of 26

ATTACHMENT 2 – DED

Please see attached electronic file.

Page 20 of 26

ATTACHMENT 3 – Client References

Use the template below to list three (3) separate and verifiable clients in the format below. The clients listed shall be for whom similar projects were completed as requested.

Reference #______

I authorize the Department to contact this reference.

Respondent Name:

STC Number:

Person Submitting Quote:

Signature:

Date:

Project Title

Client Organization

Client Contact or Reference

Client Phone

Client Email Address

Period of Performance (initial and final). Explain any delay in project completion

Contract Value (initial and final). Explain any growth in contract value.

Degree of project success – customer acceptance, success in meeting organization goals, on-budget delivery of services.

Describe how services are similar to the services requested in this RFQ.

Page 21 of 26

Addendum A Public Records Provisions

1. Public Records.

a. Notwithstanding any provisions to the contrary, disclosure of any records made or received by the State of Florida in conjunction with this Contract will be governed by the provisions of Chapter 119, F.S., section 24(a) of Article I of the Florida Constitution, or as otherwise provided by law (Public Records Law). The Department will respond to public records or other disclosure requests for records or information marked as trade secret pursuant to section 624.4213, F.S., in accordance with the provisions specified in that statute.

b. The Contractor shall allow public access to all documents, papers, letters, or other material, regardless of the physical form, characteristics, or means of transmission (Public Records) made or received by the Contractor in conjunction with this Contract, unless the Public Records are exempt from section 24(a) of Article I of the Florida Constitution or section 119.07(1), F.S. The Contractor is responsible for becoming familiar with Florida Public Records Law with regard to such records. The Department may unilaterally terminate this Contract if the Contractor refuses to allow public access as required by law.

2. Confidential Information.

a. The Contractor’s Submissions. If the Contractor has a reasonable, legal basis to assert that any portion of any records submitted to the Department are confidential, proprietary, trade secret, or otherwise not subject to disclosure (Confidential) under Public Records Law or other authority, the Contractor must simultaneously provide the Department with a separate redacted copy of the records the Contractor claims as Confidential and briefly describe in writing the grounds for claiming exemption from the Public Records Law, including the specific statutory citation for such exemption. This redacted copy of the records shall contain the Contract name and number, and shall be clearly labeled “Confidential.” The redacted copy of the records should only redact those portions of the records that the Contractor claims are Confidential. If the Contractor fails to submit a redacted copy of records it claims are Confidential, such action may constitute a waiver of any claim of confidentiality.

b. Public Records or other Disclosure Request. If a Public Records or other disclosure request is made to the Contractor, the Contractor shall immediately notify the Department of such request. In the event of a Public Records or other disclosure request made pursuant to Public Records Law, and if records that have been marked and identified as “Confidential” are responsive to such request, the Department shall provide the Contractor-redacted copies to the requester. If a requester asserts a right to the portions of records claimed as Confidential, the Department shall notify the Contractor that such an assertion has been made. It is the Contractor’s responsibility to assert that the portions of records in question are exempt from disclosure under Public Records Law or other applicable law. If the Department becomes subject to a demand for discovery or disclosure of the portions of records the Contractor claims as Confidential in a legal

Page 22 of 26

proceeding, the Department shall give the Contractor prompt notice of the demand, when possible, prior to releasing the portions of records the Contractor claims as Confidential (unless disclosure is otherwise prohibited by applicable law). The Contractor shall be responsible for defending its determination that the redacted portions of its records are Confidential. No right or remedy for damages against the Department arises from any disclosure made by the Department based on the Contractor’s failure to promptly legally protect its claim of exemption and commence such protective actions within ten days of receipt of such notice from the Department.

c. Requirements for the Contractor. i) Confidentiality. The Contractor shall ensure that exempt or confidential and exempt

records are not disclosed except as permitted by the Contract or by Public Records Law. Disclosure by the Contractor shall only occur after the Contractor provides written notice to the Department.

ii) Records Retention. During the Contract term, the Contractor shall retain all records made or received by the Contractor in conjunction with the Contract according to the respective records’ retention schedule under applicable law. The Contractor shall retain such records for the longer of five years after the expiration of the Contract and all pending matters, or the period required by the General Records Schedules maintained by the Florida Department of State (available at: http://dlis.dos.state.fl.us/recordsmgmt/gen_records_schedules.cfm), whichever is longer. If the Contractor’s record retention requirements terminate prior to the requirements stated herein, the Contractor may meet the Department’s record retention requirements for this Contract by transferring its records to the Department at that time, and by destroying duplicate records in accordance with section 501.171, F.S., and, if applicable, section 119.0701, F.S. The Contractor shall adhere to established information destruction standards such as those established by the National Institute of Standards and Technology Special Publication 800-88, “Guidelines for Media Sanitization” (2014). See http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf.

iii) Section 119.0701(2), F.S., Requirements (unless otherwise required by Chapter 2016-20, Laws of Florida). Additionally, if for purposes of this Contract, the Contractor is a “contractor” as defined in section 119.0701(1)(a), F.S., and is acting on behalf of the Department as provided under section 119.011(2), F.S., the Contractor shall:

(1) Keep and maintain Public Records required by the Department to perform the service.

(2) Requested records or allow the records to be inspected or copied within a reasonable time at a cost that does not exceed the cost provided in Chapter 119, F.S., or as otherwise provided by law.

(3) Ensure that Public Records that are exempt or confidential and exempt from Public Records disclosure requirements are not disclosed except as authorized by law for the duration of the Contract term and following the completion of the Contract if the Contractor does not transfer the records to the Department.

(4) Upon completion of the Contract, the Contractor shall transfer, at no cost, to the Department all Public Records in possession of the Contractor or keep and maintain public records required by the Department to perform the service. If the Contractor transfers all public records to the Department upon completion of the Contract, the Contractor shall destroy any duplicate Public Records that are exempt or confidential and exempt from Public Records disclosure requirements. If the Contractor keeps and maintains Public Records upon completion of the Contract, the Contractor shall meet all applicable requirements for retaining the Public

Page 23 of 26

Records. All records stored electronically must be provided to the Department in a format specified by the Department as compatible with the information technology systems of the Department. These formatting requirements are satisfied by using the data formats as authorized in the Contract or Microsoft Word, Outlook, Adobe, or Excel, and any software formats the Contractor is authorized to access. If the Contractor retains records pursuant to other legal requirements, then the retention requirements of subsection 2.c.(ii) above shall apply.

(5) IF THE CONTRACTOR HAS QUESTIONS REGARDING THE APPLICATION OF CHAPTER119, FLORIDA STATUTES, TO THE CONTRACTOR’S DUTY TO PROVIDE PUBLIC RECORDS RELATING TO THIS CONTRACT, CONTACT the Department of Financial Services, Division of Legal Services, Office of Public Records (custodian of public records) AT telephone: 850-413-3149, PublicRecordsRequest@myfloridacfo.com, and mailing address: 200 E. Gaines Street, Larson Building Suite B-15, Tallahassee, FL 32399-0311.

3. Failure to Comply with Public Records Requirements. If the Contractor fails to comply with the requirements regarding response to Public Records or other disclosure requests, the Department, at its option, may enforce these provisions by exercising termination rights as described in the Contract. Nothing in this Addendum limits the Contractor’s responsibility or liability for the release of confidential or exempt information. Nothing in this Addendum waives the Department’s sovereign immunity.

4. Records Excluded from Inspection, Copying, and Auditing Requirements. The following records are specifically excluded from inspection, copying, and audit rights under the Contract:

i) Records of the Contractor (and subcontractors) that are unrelated to the Contract; ii) Documents created by and for the Department or other related communication that are

confidential attorney work product or subject to attorney-client privilege, unless those documents would be produced for inspection and copying by the Department under the requirements of Public Records Law;

iii) The Contractor’s (and subcontractors’) internal cost and resource utilization data, or data related to employees, or records related to other customers of the Contractor, or any subcontractor who is not performing services under this Contract; and

iv) Records that are trade secrets, proprietary information, or otherwise exempt from the requirements of Public Records Law.

Page 24 of 26

Addendum B Data Security Requirements

1. Data Security, Recovery, and Damages for Non-Performance. a. Data Security. The Contractor, its employees, subcontractors and agents shall comply with

all information technology security procedures of the Department in performance of this Contract. The Contractor shall provide immediate notice to the Department’s Information Security Office (ISO) in the event it becomes aware of any security breach and any unauthorized transmission or loss of any or all of the data collected or created for or provided by the Department (State Data) or, to the extent the Contractor is allowed any access to Department information technology (IT) resources, provide immediate notice to the ISO, of any allegation or suspected violation of security procedures of the Department. Except as required by law or legal process and after notice to the Department, the Contractor shall not divulge to third parties any confidential information obtained by the Contractor or its agents, distributors, resellers, subcontractors, officers or employees in the course of performing Contract work according to applicable rules, including, but not limited to, Rule Chapter 74-2 , F.A.C., security procedures, business operations information, or commercial proprietary information in the possession of the State or the Department. The Contractor shall not be required to keep confidential information that is publicly available through no fault of the Contractor, material that the Contractor developed independently without relying on the State’s confidential information or information that is otherwise obtainable under State law as a public record.

b. Loss of Data. In the event of loss of any State Data or record where such loss is due to the negligence of the Contractor or any of its subcontractors or agents, the Contractor shall be responsible for recreating such lost data in the manner and on the schedule set by the Department at the Contractor’s sole expense, in addition to any other damages the Department may be entitled to by law or the Contract. In the event lost or damaged data is suspected, the Contractor will perform due diligence and report findings to the Department and perform efforts to recover the data. If is unrecoverable, the Contractor will pay all the related costs associated with the remediation and correction of the problems engendered by any given specific loss. Further, failure to maintain security that results in certain data release will subject the Contractor to the administrative sanctions for failure to comply with section 501.171, F. S., together with any costs to the Department of such breach of security caused by the Contractor. If State Data will reside in the Contractor’s system, the Department may conduct, or request the Contractor conduct at the Contractor’s expense, annual network penetration test or security audit of the Contractor’s system(s) on which State Data resides. If the Contract is less than a year long, the penetration test or security audit of the Contractor’s system(s) on which State Data resides this right can be exercised at any time.

c. Data Protection. No State Data or information will be transmitted to, stored in, processed in, or shipped to off-shore locations or out of the United States of America regardless of method, except as required by law. Examples of these methods include (but are not limited to): FTP transfer, DVD, tape, or drive shipping; regardless of level of encryption employed. Access to State Data shall only be available to approved and authorized staff, including remote/offshore personnel, that have a legitimate business need. Requests for remote access shall be submitted to the Department’s Help Desk. With approval, third parties may be granted time-limited terminal service access to information technology resources as necessary for fulfillment of related responsibilities. Third parties shall not be granted remote access via

Page 25 of 26

VPN, private line, or firewall holes. Requests for exceptions to this provision may be submitted to the Department for approval. Remote connections are subject to detailed monitoring via two-way log reviews and the use of other tools, as deemed appropriate. When remote access needs change, the ISO shall be promptly notified and access shall be removed promptly.

d. The Contractor shall encrypt all data transmissions containing confidential or confidential and exempt information. Remote data access must be provided via a trusted method such as SSL, TLS, SSH, VPN, IPSec, SFTP or a comparable protocol approved by the Department. Confidential information must be encrypted using an approved encryption technology when transmitted outside of the network or over a medium not entirely owned for managed by the Department.

e. The Contractor agrees to protect, indemnify, defend and hold harmless the Department from and against any and all costs, claims, demands, damages, losses and liabilities arising from or in any way related to the Contractor’s breach of data security or the negligent acts or omissions of the Contractor related to this subsection.

f. All employees, subcontractors, or agents performing work under the Contract must comply with all security and administrative requirements of the Department. The Contractor shall not divulge to third parties any confidential information obtained by the Contractor or its agents, distributors, resellers, subcontractors, officers or employees in the course of performing Contract work.

g. Specific security requirements. The parties shall not use or further disclose the data specified in this Contract except as permitted by this Contract or as required by federal law, including the Health Information Portability and Accountability Act (HIPAA) and the Health Information Technology Economic and Clinical Health (HITECH) Act, their associated regulations, 45 CFR 160, 162 and 164, and applicable Florida law. Disclosure to the Department is expressly permitted under federal law for complying with State law, and Florida and the Department is an “authorized public official” rather than a "covered entity" under federal law. See 45 C.F.R. 164.512 and 45 C.F.R. 164.514. The parties have established appropriate administrative, technical, and physical safeguards to protect the confidentiality and to prevent unauthorized use or access to the data specified in this Contract. Further, the uses and disclosures shall be in accordance with applicable Florida law. Any CJIS and/or HIPAA-specific security requirements are attached in a separate addendum, if applicable.

h. The Contractor shall maintain and secure adequate back-up files of all documentation and programs utilized to process State Data submissions. The Contractor shall develop data security procedures to ensure only authorized access to data submissions and databases by personnel for contracted activities. The Contractor shall develop data security procedures to ensure no unauthorized access to data submissions and databases by individuals other than those authorized by the Contract or designated representatives of the Department.

i. State Data and shared data will be made available to the Department upon its request, in the form and format reasonably requested by the Department. The Contractor and its representatives will not sell, assign, lease, or otherwise dispose of any State Data to third parties or commercially exploit State Data other than for the benefit of the Department and State of Florida agencies as authorized by the Contract, nor will any employee of the Contractor other than those on a strictly need to know basis have access to the State Data. The Contractor will not possess or assert any lien or other right against or to any State Data in any circumstances.

j. At the initiation of the contract, the Contractor shall meet or exceed level of security required of the Department’s agency Policies and Procedures # 4-03, Information Technology Security Policy, a copy of which will be provided by the Contract Manager upon request. Further,

Page 26 of 26

failure to maintain security that results in data release will subject the Contractor to possible termination and to the administrative sanctions for failure to comply with section 501.171, F.S., together with any actual costs to the Department resulting from a breach of security.

k. Technology/Systems Disaster Recovery. i) Any monetary losses due to nonperformance from providing secure availability to the

Contractor’s web-based system, the stability of the system, adequate safeguards to prevent unauthorized entry into the Department’s account, and response to Acts of God will be reimbursed at the same amount as the loss.

ii) The Contractor shall perform a successful Disaster Recovery test yearly and shall annually provide the summary statement of an independent auditor as to the successful performance of such Disaster Recovery test. The Department shall be entitled to a 2% holdback of payment from each invoice after the anniversary date that the independent auditor’s confirmation of the test is not timely received within the timeframes required by the parties’ agreed schedule. Holdback will be applied to the next billing cycle after the anniversary.

2. Contract Provisions Specific to Online Services.

Audits and Data Retention. The Contractor will timely cooperate in completion of all audits and data retention required by Florida law, applicable industry rules, or applicable federal law. The Department will respect the security restrictions of the Contractor regarding inspections pursuant to PUR 1000, section 7 to the extent permitted by law and limit such inspections to relevant records during normal business hours. Failure to meet data retention requirements related to the Services will be considered a material breach of the Contract and cause for termination. If any audit of the Contractor’s charges reflect that the Contractor has incorrectly invoiced the Department, the Contractor will issue, on the next invoice submitted to Department pursuant to this Contract, a credit or debit, as appropriate, to correct the inaccuracy.

3. Data Access.

a. All Contractor personnel who will have access to State Data will undergo the background checks and screenings described in the Statement of Work.

b. Cooperation with the State and Third Parties. The Contractor agrees to cooperate with the following entities: (i) the State, (ii) the State’s other subcontractors, (iii) the State’s agents, including properly authorized governmental entities, (iv) the State’s authorized third parties, such as technology staff under contract with the State, and (v) other properly authorized individuals who directly or indirectly access State Data on behalf of any of the entities listed in this section. The Contractor shall also provide reasonable access to Contractor’s Contract personnel, systems, and facilities to these same entities, when reasonably requested by the Department. The Contractor agrees to impose these same requirements on all subcontractors performing the work of this Contract.

4. Exit Transition Requirements.

Upon the earlier of six (6) months before the expiration of the Contract or upon any notice of termination of the Contract, the Contractor shall provide transition services (Exit Transition Services) to the Department without regard to the reason for termination, as stated herein. Exit Transition Services shall be provided for up to the period outlined in the Statement of Work during the term and after termination and will be limited to post-contract activities involving knowledge transfer for such services and deliverables and all reasonable termination assistance requested by the Department to facilitate the orderly transfer of such services to the Department or its designees.